fix(copilot): honor reasoning effort and deliver pinned review diffs

.flow/specs/fn-304-honor-copilot-reasoning-effort-for.json

@@ -0,0 +1,177 @@
+{
+  "branch_name": "fix/copilot-high-effort-upstream-20261018",
+  "completion_review_status": "ship",
+  "completion_reviewed_at": "2026-10-17T23:26:33.969358Z",
+  "created_at": "2026-10-17T12:06:02.104471Z",
+  "default_impl": null,
+  "default_review": "copilot:claude-opus-5.5:high",
+  "default_sync": null,
+  "depends_on_epics": [],
+  "id": "fn-304-honor-copilot-reasoning-effort-for",
+  "impl_review_rounds": {
+    "fn-304-honor-copilot-reasoning-effort-for.1": 0
+  },
+  "next_task": 1,
+  "no_plan": true,
+  "plan_review_rounds": 0,
+  "plan_review_status": "unknown",
+  "plan_reviewed_at": null,
+  "review_attempts": [
+    {
+      "artifact_sha256": "ff3f8bff36dda4377eac82a9531f186ac0d8807451b0d236e1a5f4a6b87fecdf",
+      "backend": "copilot",
+      "base_sha": "627efd03862b663482ec34a66d7559f482a14529",
+      "counter_kind": "impl",
+      "effort": "high",
+      "failure_class": null,
+      "finalized": {
+        "digest": "complete",
+        "receipt": "complete",
+        "status": "not_applicable"
+      },
+      "findings_digest": {
+        "backend": "copilot",
+        "digest_truncated": false,
+        "items": [],
+        "reviewKind": "implementation"
+      },
+      "forced": false,
+      "hash_epoch": 0,
+      "head_sha": "b5d103c1bddec7c114926108c5795ee29adb3799",
+      "head_sha_observed": true,
+      "kind": "impl",
+      "model": "claude-opus-5.5",
+      "outcome": "verdict",
+      "output_bytes": 2023,
+      "output_sha256": "88082584910c002716755b141bc93feee4ec6dfa3c559587859939a82a7bf733",
+      "reservation_id": "6e3c4750889e48ffa25228bb5eb678dc",
+      "round_consumed": true,
+      "scope": "impl:fn-304-honor-copilot-reasoning-effort-for.1",
+      "superseded_by": null,
+      "task": "fn-304-honor-copilot-reasoning-effort-for.1",
+      "timestamp": "2026-10-17T12:30:06.860518Z",
+      "verdict": "SHIP"
+    },
+    {
+      "artifact_sha256": "86b8b7df559d6f5543d570c695bd7de459ea83270970590fb31c79a46f3d78f7",
+      "backend": "copilot",
+      "base_sha": "627efd03862b663482ec34a66d7559f482a14529",
+      "counter_kind": "impl",
+      "effort": "high",
+      "failure_class": null,
+      "finalized": {
+        "digest": "complete",
+        "receipt": "complete",
+        "status": "not_applicable"
+      },
+      "findings_digest": {
+        "backend": "copilot",
+        "digest_truncated": false,
+        "items": [
+          {
+            "chainRoot": "finding-d9e04a522df5b78dce5a842c07b20166",
+            "classification": "introduced",
+            "findingId": "finding-d9e04a522df5b78dce5a842c07b20166",
+            "firstSeenThisRound": true,
+            "severity": "P3",
+            "status": "open"
+          },
+          {
+            "chainRoot": "finding-47004e06dbaa66d5b9d32ba5d6ceb890",
+            "classification": "pre_existing",
+            "findingId": "finding-47004e06dbaa66d5b9d32ba5d6ceb890",
+            "firstSeenThisRound": true,
+            "severity": "P3",
+            "status": "open"
+          }
+        ],
+        "reviewKind": "implementation"
+      },
+      "forced": false,
+      "hash_epoch": 1,
+      "head_sha": "97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc",
+      "head_sha_observed": true,
+      "kind": "impl",
+      "model": "claude-opus-5.5",
+      "outcome": "verdict",
+      "output_bytes": 3761,
+      "output_sha256": "6b90bb42f435f587e6b62c5aacf9d82ea132378b394009d08f1de14b15a091a2",
+      "reservation_id": "5388114c8c654382b763cc413d9b7cc6",
+      "round_consumed": true,
+      "scope": "impl:fn-304-honor-copilot-reasoning-effort-for.1",
+      "superseded_by": null,
+      "task": "fn-304-honor-copilot-reasoning-effort-for.1",
+      "timestamp": "2026-10-17T12:50:23.078553Z",
+      "verdict": "SHIP"
+    },
+    {
+      "artifact_sha256": "424fa9ecb2c47bb1be6845b4d83c8239122d230b09a239df856c9b0254368cbf",
+      "backend": "copilot",
+      "base_sha": "f360d3a8d1d3f16b83f60fd4d3a6e8d1e67b7282",
+      "counter_kind": "plan",
+      "effort": "high",
+      "failure_class": null,
+      "finalized": {
+        "digest": "complete",
+        "receipt": "complete",
+        "status": "complete"
+      },
+      "findings_digest": {
+        "backend": "copilot",
+        "digest_truncated": false,
+        "items": [
+          {
+            "chainRoot": "finding-ebead2a01b5751b897be359c36676198",
+            "classification": "pre_existing",
+            "findingId": "finding-ebead2a01b5751b897be359c36676198",
+            "firstSeenThisRound": true,
+            "severity": "P3",
+            "status": "open"
+          }
+        ],
+        "reviewKind": "completion"
+      },
+      "forced": false,
+      "hash_epoch": 0,
+      "head_sha": "ae80c9c5c327e0c6120d96d9b2482b8dd170bc28",
+      "head_sha_observed": true,
+      "kind": "completion",
+      "model": "claude-opus-5.5",
+      "outcome": "verdict",
+      "output_bytes": 4963,
+      "output_sha256": "8a96c671ede75396e71c4e6ff20db4b62f649445a94b578914274451399daeea",
+      "reservation_id": "c6d02cb8b78f4ad3aa8abfef78f5954a",
+      "round_consumed": true,
+      "scope": "completion",
+      "superseded_by": null,
+      "task": null,
+      "timestamp": "2026-10-17T23:26:33.967133Z",
+      "verdict": "SHIP"
+    }
+  ],
+  "review_hash_epoch": {
+    "impl:fn-304-honor-copilot-reasoning-effort-for.1": 2,
+    "plan#completion": 1
+  },
+  "review_pending_rounds": {},
+  "review_reservations": {},
+  "review_transport_failures": {
+    "completion": 0,
+    "impl:fn-304-honor-copilot-reasoning-effort-for.1": 0
+  },
+  "spec_path": ".flow/specs/fn-304-honor-copilot-reasoning-effort-for.md",
+  "status": "done",
+  "title": "Honor Copilot reasoning effort for Claude reviews",
+  "tracker": {
+    "baseHashFlow": null,
+    "baseHashTracker": null,
+    "depRelations": [],
+    "id": null,
+    "identifier": null,
+    "lastSyncedAt": null,
+    "mergeBaseFlow": null,
+    "mergeBaseTracker": null,
+    "url": null
+  },
+  "updated_at": "2026-10-17T23:26:33.969773Z"
+}

.flow/specs/fn-304-honor-copilot-reasoning-effort-for.md

@@ -0,0 +1,14 @@
+# Copilot reasoning effort and review diff transport
+
+## Problem
+
+`run_copilot_exec` previously omitted reasoning effort for Claude-family models and sent OpenAI-family models the `--effort` option. The installed GitHub Copilot CLI 1.0.98 help exposes `--reasoning-effort` with `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`, so the resolved effort must use that option.
+
+Copilot review sessions also deny shell access while the shared review prompts ask reviewers to inspect the Git diff. In review run `RID6e3c4750889e48ffa25228bb5eb678dc` over `627efd03862b663482ec34a66d7559f482a14529..b5d103c1bddec7c114926108c5795ee29adb3799`, all three sessions returned `SHIP` after auditing current files without reading the patch. That recorded verdict has no diff coverage and is incomplete. Copilot primary reviews and fanout draws need the exact pinned diff at a readable path and instructions to use the available read-only file tools while shell remains denied. Preserve the existing Claude transport behavior.
+
+## Acceptance criteria
+
+- **R1:** For Claude-family and OpenAI-family models, dispatch the resolved effort, including `high`, using the CLI-supported `--reasoning-effort` option.
+- **R2:** At the model-resolution floor, omit `--reasoning-effort` and keep the receipt truthful about the effective model and effort.
+- **R3:** Preserve read-only tool restrictions, POSIX and Windows prompt delivery, first-call and resumed session behavior, model-unavailable fallback classification, and accurate receipts for non-floor dispatches.
+- **R4:** For Copilot primary implementation, plan, and completion reviews, plus each implementation fanout draw, materialize the exact pinned base-to-head diff before managed or CLI dispatch and tell the reviewer to read it with the available read-only file tools because shell access is denied. Keep receipt and range identity in the diff filename, fail before dispatch when materialization fails, and preserve Claude diff delivery behavior.

.flow/tasks/fn-304-honor-copilot-reasoning-effort-for.1.json

@@ -0,0 +1,16 @@
+{
+  "assignee": null,
+  "claim_note": "",
+  "claimed_at": null,
+  "created_at": "2026-10-17T12:06:13.517825Z",
+  "depends_on": [],
+  "id": "fn-304-honor-copilot-reasoning-effort-for.1",
+  "implicit_owner": true,
+  "priority": null,
+  "review": "copilot:claude-opus-5.5:high",
+  "spec": "fn-304-honor-copilot-reasoning-effort-for",
+  "spec_path": ".flow/tasks/fn-304-honor-copilot-reasoning-effort-for.1.md",
+  "status": "done",
+  "title": "Pass supported Copilot reasoning effort without family omissions",
+  "updated_at": "2026-10-17T12:39:57.767045Z"
+}

.flow/tasks/fn-304-honor-copilot-reasoning-effort-for.1.md

@@ -0,0 +1,77 @@
+---
+satisfies: [R1, R2, R3, R4]
+---
+# fn-304-honor-copilot-reasoning-effort-for.1 Pass supported Copilot reasoning effort without family omissions
+
+## Description
+# Copilot Claude effort dispatch
+
+### Problem
+
+`run_copilot_exec` currently omits reasoning effort for Claude-family models and sends OpenAI-family models the `--effort` option. The installed GitHub Copilot CLI 1.0.98 help exposes `--reasoning-effort` with `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, and `max`. As a result, a resolved Claude effort such as `high` is not delivered to the CLI, while the existing OpenAI dispatch option does not match the installed CLI contract.
+
+Copilot review sessions deny shell access while shared prompts ask the reviewer to inspect the Git diff. Review run `RID6e3c4750889e48ffa25228bb5eb678dc` over `627efd03862b663482ec34a66d7559f482a14529..b5d103c1bddec7c114926108c5795ee29adb3799` returned three mechanical `SHIP` verdicts without any reviewer reading the patch. The recorded run has no diff coverage and is incomplete; Copilot primary reviews and fanout draws need the pinned diff at a readable path, with instructions to use available read-only file tools. Claude's current diff delivery remains supported.
+
+### Acceptance criteria
+
+- **R1:** For Claude-family and OpenAI-family models, dispatch the resolved effort, including `high`, using the CLI-supported `--reasoning-effort` option.
+- **R2:** At the model-resolution floor, omit `--reasoning-effort` and keep the receipt truthful about the effective model and effort.
+- **R3:** Preserve read-only tool restrictions, POSIX and Windows prompt delivery, first-call and resumed session behavior, model-unavailable fallback classification, and accurate receipts for non-floor dispatches.
+- **R4:** Deliver the exact pinned diff by readable file for Copilot primary implementation, plan, and completion reviews and implementation fanout draws. Materialize it before managed or CLI dispatch, retain receipt and range identity, direct Copilot to available read-only file tools while shell is denied, fail closed before dispatch if materialization fails, and preserve Claude transport behavior.
+
+## Acceptance
+- [ ] Copilot primary implementation, plan, and completion dispatches materialize the exact reviewed base-to-head diff before execution and identify the readable file in the prompt.
+- [ ] Every Copilot implementation fanout draw retains its receipt, range, and axis identity in the materialized diff path.
+- [ ] Copilot transport instructions accurately describe denied shell/write tools and direct the reviewer to read the file with available read-only tools.
+- [ ] Diff materialization failures stop before managed or CLI execution, while existing Claude diff transport, guards, and path identity remain unchanged.
+
+## Done summary
+# Task handoff: Copilot reasoning effort and pinned review diffs
+
+### Implementation status
+
+The implementation is complete at source revision `97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc`. This follow-up addresses the final implementation review's introduced P3 documentation omission in the two canonical docs and their generated Codex mirrors. No Python behavior, tests, spec state, or task state changed in this follow-up.
+
+### Acceptance coverage
+
+| Requirement | Evidence |
+| --- | --- |
+| R1 | Copilot sends the resolved `--reasoning-effort` for supported Claude-family and OpenAI-family models, including `high`. The implementation review verified `run_copilot_exec` and coverage for Claude Opus, Haiku, and GPT. |
+| R2 | The `auto` fallback floor omits `--reasoning-effort`; its receipt and attempt row omit the unselected effort. `test_floor_uses_auto_and_omits_reasoning_effort` covers this. |
+| R3 | Shell/write denials, POSIX argv and Windows stdin prompt delivery, create/resume markers, model-unavailable fallback classification, and non-floor receipts remain covered by source tests. |
+| R4 | Primary implementation, plan, and completion reviews plus every implementation fan-out draw receive the complete pinned diff by readable path before dispatch. Failed materialization stops before managed or CLI dispatch. The current docs name the path and the read-only file-viewing tools while preserving shell/write denials. |
+
+### Review record
+
+- Official implementation review run `5388114c8c654382b763cc413d9b7cc6` returned `SHIP` from independent correctness, contracts, and integration sessions.
+- Exact reviewed range: `627efd03862b663482ec34a66d7559f482a14529..97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc`.
+- The review evidence records all three sessions reading byte-equal views of the complete 38,696-byte pinned diff and assessing R1-R4 across all nine source paths. Reviewers did not run tests.
+- The earlier run `6e3c4750889e48ffa25228bb5eb678dc` recorded a mechanical `SHIP` but the sessions read no patch because shell access was denied. Its preserved receipt is incomplete and was not accepted as review coverage.
+- Final review finding: introduced P3 at `plugins/flow-next/docs/flowctl.md` and `plugins/flow-next/skills/flow-next-impl-review/workflow-cli.md`; addressed by this documentation follow-up.
+- The pre-existing P3 about the opt-in Copilot triage judge's older effort flag is outside this task and remains untouched.
+
+### Documentation follow-up
+
+Updated the Copilot backend entries in `plugins/flow-next/docs/flowctl.md` and `plugins/flow-next/skills/flow-next-impl-review/workflow-cli.md`. Both now describe the pinned diff under `.flow/tmp/claude-review/`, the available read-only file-viewing tools, denied shell/write access, and failure before dispatch. `scripts/sync-codex.sh` generated the corresponding two Codex mirror updates.
+
+The existing flow-next.dev Copilot paragraph is at [Review backends, Per-backend notes](https://flow-next.dev/reference/review-backends/). It currently states the read-only tool restriction but omits pinned-diff delivery. No local website source checkout was available in this worktree or the bounded Dev/Worktrees search, so no site edit or publication was made; root can inspect site ownership for a separate source update.
+
+### Validation
+
+- Source freeze at `97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc`: preserved `python3 scripts/run_tests_parallel.py` log reports 4045 tests, 0 failures, 0 errors, and 7 skipped. The source Ruff and mirror-sync checks were reported green before this documentation follow-up.
+- Final frozen documentation tree: root ran `python3 scripts/run_tests_parallel.py`; the runner reported 4045 tests, 0 failures, 0 errors, and 7 skipped in 130.39 seconds. Log: `.flow/tmp/copilot-high-effort/full-suite-final-docs.log`.
+- Follow-up: `./scripts/sync-codex.sh` passed once; `python3 scripts/check_doc_anchors.py` passed; `uvx ruff@0.16.0 check .` passed; content search confirmed the canonical text and generated mirror; `git diff --check` passed.
+- All requested local validation is complete; the coordinator owns Flow task state and Git bookkeeping.
+
+### Lifecycle handoff
+
+- Implementation review: `SHIP`, official run `5388114c8c654382b763cc413d9b7cc6`.
+- Completion review: `not_required` under the single-task policy because this task's official SHIP review covers the spec surface; no separate completion review ran.
+- QA: skipped under policy; this change has no UI path.
+- The coordinator owns Flow task state and Git bookkeeping.
+
+stage: plan-sync - skipped(config: planSync.enabled != true)
+## Evidence
+- Commits: b5d103c1bddec7c114926108c5795ee29adb3799, 97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc
+- Tests: python3 scripts/run_tests_parallel.py at source freeze 97f0cd4a8e4ebc7c3665ff975358d2d0c571b0bc: 4045 tests reported, 0 failures, 0 errors, 7 skipped, python3 scripts/run_tests_parallel.py on final documentation tree: 4045 tests reported, 0 failures, 0 errors, 7 skipped; root run completed in 130.39s, uvx ruff@0.16.0 check .: passed at source freeze and documentation follow-up, ./scripts/sync-codex.sh: passed once for canonical documentation follow-up, python3 scripts/check_doc_anchors.py: passed, git diff --check: passed, full repository suite after documentation freeze: passed; .flow/tmp/copilot-high-effort/full-suite-final-docs.log
+- PRs:

CHANGELOG.md

@@ -6,6 +6,10 @@ Flow-Next changed shape with 5.0.0. One command, `/flow-next:flow`, reads whatev
 
 ## Unreleased
 
+### Fixed
+
+- **Copilot reviews honor the selected reasoning effort and see the complete pinned change.** The review dispatch passes that effort for Claude and OpenAI models and provides the exact implementation, plan, completion, or fan-out diff at a readable path.
+
 ## [flow-next 9.0.0] - 2026-10-17
 
 `/flow-next:flow --goal` takes on work bigger than one spec. Give it a goal as a goal spec, a PRD, a migration target or a single sentence. It measures where things stand against the goal's criteria, writes a spec for the biggest gap, builds it through the normal pipeline with the same reviews and gates as a spec you wrote, then measures again. It keeps going until every criterion has evidence behind it. Each child spec lands on an integration branch, and the goal reaches your default branch in one final pull request with a full review. A goal that takes days picks up where it left off. [Goal mode](https://flow-next.dev/autonomy/goal-mode/) shows how to start one. Thanks to @DanielKillenberger for proposing it in #559.

plugins/flow-next/codex/docs/flow-next/flowctl.md

@@ -2783,6 +2783,8 @@ flowctl copilot deep-pass --pass adversarial|security|performance \
 
 Spec form: `copilot[:model[:effort]]`. Default model resolved via env (`FLOW_COPILOT_MODEL`) / config / registry. Receipt fields mirror codex: `mode: "copilot"`, `session_id` for resume.
 
+For implementation, plan, and completion reviews, and each implementation-review fan-out draw, Copilot receives the complete pinned diff by path under `.flow/tmp/claude-review/`. The reviewer reads it with available read-only file-viewing tools; shell and write tools are denied. If the diff cannot be written, review dispatch stops before the managed or CLI reviewer starts.
+
 ### cursor
 
 Cursor `cursor-agent` CLI wrappers - alternative review backend, parallel to codex/copilot. Same review criteria (Carmack-level, 7 each for plan/impl), same receipt schema, same session-resume model. Unlocks Cursor-billed review (your existing Cursor subscription, no separate API key) and reviewer models from families the other backends can't reach in one place - ask `cursor-agent --list-models` for the current set rather than copying identifiers from here.

plugins/flow-next/codex/skills/flow-next-impl-review/workflow-cli.md

@@ -332,7 +332,7 @@ Grammar and defaults: [references/backend-specs.md](references/backend-specs.md)
   ladder's floor no model or effort is sent and the receipt records `"effort": null`.
   On a Claude-family writer the review is same-family: the receipt records it and the run
   proceeds; prefer `codex` or `host` when family independence matters.
-- **copilot** — the Copilot CLI; session ids are client-minted (create-or-resume).
+- **copilot** — the Copilot CLI; session ids are client-minted (create-or-resume). Primary implementation, plan, and completion reviews, plus each implementation fan-out draw, receive the complete pinned diff by path under `.flow/tmp/claude-review/`. Copilot reads it with available read-only file-viewing tools; shell and write tools are denied. If the diff cannot be written, dispatch stops before the managed or CLI reviewer starts.
 - **cursor** — `cursor-agent -p --output-format json --trust --mode ask` (read-only). No
   effort field: Cursor folds effort into the model name, and `cursor:<model>:<effort>` is
   rejected.